Automatic iPhone reboot: Forensics firm allegedly stops time
Magnet Forensics, the company behind the iPhone unlocking tool Graykey for investigative authorities, has apparently succeeded in circumventing – or at least delaying – a security feature used by Apple since iOS 18 (and tightened with iOS 18.1). This concerns the automatic reboot of the devices, which puts them into a secure mode (“Before First Unlock”) where they can only be attacked with difficulty via the USB-C interface. As the US investigative media 404 Media reports, citing a company video, Magnet Forensics seems to have found a method to outsmart the “Inactivity Reboot,” which actually starts after 72 hours. If iPhones are not unlocked for three days, they automatically restart. After the reboot, the Apple device is considered almost locked, which represents a major hurdle for police authorities, intelligence agencies, or thieves trying to unlock devices.
Continue after ad
Magnet Forensics: “Secure evidence”
When Apple introduced the feature, there was criticism of the company. Investigators often fail to open the devices within the 72-hour period, whether due to a lack of court orders or other reasons. This makes it significantly more difficult for them to gain access, even with specialized devices like those from Magnet Forensics. According to 404 Media, Magnet Forensics has therefore developed a new specialized device called Graykey Preserve, as well as a function called “Evidence Preservation Mode” for existing hacking tools.
The video claims that the feature is an “absolute game changer” for iOS forensics. In addition to delaying the inactivity reboot, it is also said to prevent the automatic deletion of further data, such as location data in the cache or photos and iMessage messages stored in the device’s trash.
“After First Unlock” Mode remains active
It is allegedly possible to preserve data “indefinitely.” The function for Graykey might have been available for quite some time without becoming public. According to 404 Media, the video dates from early 2025. Technical details about the implementation are missing, but there are some indications. For example, Graykey Preserve activates airplane mode, thus disabling Bluetooth, WLAN, and mobile data. Furthermore, the so-called “After First Unlock” mode, which allows data access via USB-C, is said to remain active even after a reboot “for whatever reason.”
[](https://www.heise.de/en/news/Dimensional-drawings-Apple-releases-blueprints-of-new-hardware-11474822.html)
---
[](https://www.heise.de/en/news/US-Provider-iPhone-18-Pro-and-iPhone-18-Pro-Max-have-connection-issues-11474788.html)
---
[](https://www.heise.de/en/news/Square-Leak-shows-possible-photo-homescreen-for-new-Apple-device-11474652.html)
---
[](https://www.heise.de/en/news/Samsung-Galaxy-SmartTag-3-Small-light-answer-to-AirTags-with-iOS-support-11474413.html)
---
[](https://www.heise.de/en/news/Thunderbird-for-iOS-The-first-beta-is-getting-closer-11474023.html)
Mehr anzeigenWeniger anzeigen
Neither Apple nor Magnet Forensics have commented on the report. iPhone security expert Jiska Classen, professor at the Hasso Plattner Institute in Potsdam, suspects that Magnet Forensics is somehow manipulating the iPhone’s clock to “stop time” or at least slow it down. Graykey apparently prevents Apple’s time limits for deletion and reboot from expiring. However, users should be able to bypass all of this by completely shutting down their device before it is confiscated.
Continue after ad
Empfohlener redaktioneller Inhalt
Mit Ihrer Zustimmung wird hier ein externer Preisvergleich (heise Preisvergleich) geladen.
Preisvergleich jetzt laden
Ich bin damit einverstanden, dass mir externe Inhalte angezeigt werden. Damit können personenbezogene Daten an Drittplattformen (heise Preisvergleich) übermittelt werden. Mehr dazu in unserer Datenschutzerklärung.
(bsc)
Don't miss any news – follow us on Facebook, LinkedIn or Mastodon.
This article was originally published in German. It was translated with technical assistance and editorially reviewed before publication.